@@ -61,71 +61,8 @@ reviews:
6161 - Dependabot configuration
6262 - Security scanning setup
6363
64- # Infrastructure as Code and containerization
65- - path : " **/*.tf"
66- instructions : |
67- Focus on:
68- - IaC security and misconfigurations (least privilege, restricted policies)
69- - Safe defaults (no hard-coded secrets, pinned images, versioned modules)
70- - Container best practices (non-root user, slim base images, healthchecks)
71- - Network exposure and port/security group rules
72- - Kubernetes/Helm best practices (resource limits, probes, RBAC)
73-
74- - path : " **/Dockerfile"
75- instructions : |
76- Focus on:
77- - IaC security and misconfigurations (least privilege, restricted policies)
78- - Safe defaults (no hard-coded secrets, pinned images, versioned modules)
79- - Container best practices (non-root user, slim base images, healthchecks)
80- - Network exposure and port/security group rules
81- - Kubernetes/Helm best practices (resource limits, probes, RBAC)
82-
83- - path : " **/Dockerfile.*"
84- instructions : |
85- Focus on:
86- - IaC security and misconfigurations (least privilege, restricted policies)
87- - Safe defaults (no hard-coded secrets, pinned images, versioned modules)
88- - Container best practices (non-root user, slim base images, healthchecks)
89- - Network exposure and port/security group rules
90- - Kubernetes/Helm best practices (resource limits, probes, RBAC)
91-
92- - path : " **/docker-compose.yml"
93- instructions : |
94- Focus on:
95- - IaC security and misconfigurations (least privilege, restricted policies)
96- - Safe defaults (no hard-coded secrets, pinned images, versioned modules)
97- - Container best practices (non-root user, slim base images, healthchecks)
98- - Network exposure and port/security group rules
99- - Kubernetes/Helm best practices (resource limits, probes, RBAC)
100-
101- - path : " **/docker-compose.*.yml"
102- instructions : |
103- Focus on:
104- - IaC security and misconfigurations (least privilege, restricted policies)
105- - Safe defaults (no hard-coded secrets, pinned images, versioned modules)
106- - Container best practices (non-root user, slim base images, healthchecks)
107- - Network exposure and port/security group rules
108- - Kubernetes/Helm best practices (resource limits, probes, RBAC)
109-
110- - path : " helm/**/*"
111- instructions : |
112- Focus on:
113- - IaC security and misconfigurations (least privilege, restricted policies)
114- - Safe defaults (no hard-coded secrets, pinned images, versioned modules)
115- - Container best practices (non-root user, slim base images, healthchecks)
116- - Network exposure and port/security group rules
117- - Kubernetes/Helm best practices (resource limits, probes, RBAC)
118-
119- - path : " k8s/**/*"
120- instructions : |
121- Focus on:
122- - IaC security and misconfigurations (least privilege, restricted policies)
123- - Safe defaults (no hard-coded secrets, pinned images, versioned modules)
124- - Container best practices (non-root user, slim base images, healthchecks)
125- - Network exposure and port/security group rules
126- - Kubernetes/Helm best practices (resource limits, probes, RBAC)
127-
128- - path : " kubernetes/**/*"
64+ # Infrastructure-as-Code and container security (canonical rule)
65+ - path : " {**/*.tf,**/Dockerfile,**/Dockerfile.*,**/docker-compose.yml,**/docker-compose.*.yml,helm/**/*,k8s/**/*,kubernetes/**/*}"
12966 instructions : |
13067 Focus on:
13168 - IaC security and misconfigurations (least privilege, restricted policies)
0 commit comments